- [Journalist] It took less than 10 minutes
for these cybersecurity researchers
to hack into this electric vehicle charger.
- All I need is to open it up with a tool,
pop out one of the hardware chips,
and then we can read it and find your personal data.
- [Journalist] EV chargers are increasingly vulnerable
to cyber attacks that could expose sensitive data,
compromise wifi networks,
and in a worst case scenario, bring down power grids.
- We've created attacks
that could be used to switch on
thousands and thousands of EV batteries at once.
That could cause power spikes on the grid,
which could cause blackouts.
- [Journalist] This cybersecurity expert
is going to walk us through other hacking demos
to understand the risks posed by EV chargers
and what could be done to minimize these vulnerabilities.
- So I suppose we're the good guys.
Our job is to break things
to help organizations make them better.
- [Journalist] Ken Munro is the co-founder
of Pen Test Partners,
a cybersecurity research company based in the United Kingdom
that specializes in what's known as white hat hacking.
- We're brought in by organizations
to hack them in a controlled way
to find the bugs so they can get fixed,
and then the bad hackers can't get in anymore.
- [Journalist] At other times,
Pen Test carries out independent research
on products like EV Chargers.
- So this is the Wallbox.
- [Journalist] Pen Test discovered this at-home charger
had two major security flaws.
The first one, which we saw earlier,
is tied to the hardware.
- The chance is lower
'cause someone's taking a big risk to be outside your home,
but actually the consequences can be more serious
because they're getting very personal information.
When we were by the charger, we could pop the front off
and take some of the hardware out,
and from there we could get much more sensitive data.
You could access things like the homeowner's wifi key.
They might be able to intercept your passwords,
potentially stealing your banking credentials.
- [Journalist] Pen Test Partners
says there's a security flaw in the chargers processor,
which runs on a hardware platform
called Raspberry Pi Compute Module 3.
- This is the Raspberry Pi from inside the Wallbox.
Raspberry Pi's are great for education and prototyping,
but they're not really for a commercial product like this.
- [Journalist] Wallbox used this hardware
in a 2018 version of its chargers.
The module is not currently listed for industrial use
on Raspberry Pi's website.
- It's an easy way of getting to market fast.
Unfortunately, it's not great for security
when you're delivering hundreds of thousands of them.
- [Journalist] Pen Test Partners says this hardware bug
hasn't been fixed in the 2018 chargers.
But Wallbox says newer versions of the product
no longer have this vulnerability.
In a statement, a Wallbox spokesperson said,
"That in an effort to adapt to the latest regulations
and the highest standards,
they launched a new hardware platform in 2022,
which includes advanced security measures."
Raspberry Pi did not respond to requests for comment,
but Munro says newer versions of Raspberry Pi hardware
now have stronger cybersecurity.
Hackers could also infiltrate the same charger remotely.
- Probably the easiest way that we found
to get into an EV charger was over the internet,
compromising the cloud platform.
- [Journalist] Charging stations
are connected through an entire ecosystem of platforms,
like smartphone apps, cloud services, and wifi networks.
- That's the big problem.
That connectivity has brought everything together
so often one mistake in the cybersecurity
can lead to a compromise of all.
- [Journalist] For example,
Pen Test Partners found that the Wallbox charger
didn't properly verify who the user was
when the charger was controlled by its smartphone app.
- And as a result, that meant that we
could connect to anyone's charger
and tell it to turn off and on, for example.
So my colleague Dave's in the lab now
and he's gonna show just how easy it is
to turn it on and off again.
And there we go.
- [Journalist] Pen Test Partners
says it told Wallbox about the software bug
and the company says it fixed the issues shortly after.
A Wallbox spokesperson said,
"They take potential vulnerabilities incredibly seriously
and immediately fixed the software flaw
when they were alerted to the issue in 2021."
But even when software bugs like this are fixed,
users can forget to update their devices.
- The number one thing you can do for your security,
whether it's in your EV, on your phone, your home computer,
whatever it is, is apply software updates.
- [Journalist] And that's just one of the ways
a charger can be hacked.
Sometimes the vulnerabilities
are connected to design oversights,
like this charger from Project EV.
- So this is one of the chargers we had most concerns about.
We popped it open,
and obviously there's lots of charging technology in there.
But the bit that worried us is all we needed to access it
was the serial number on the side.
- [Journalist] The serial number acted as a credential
to access the chargers software.
With that, Pen Test could hijack user accounts
and prevent charging.
- And unfortunately, all those serials were sequential.
So once we had one, we could just iterate up and down
and take control of all the charges.
- [Journalist] Project EV says it fixed this flaw
by updating its software.
In a statement, a spokesperson said,
"The company treats cybersecurity very seriously
and it takes every precaution,
and the individual user must take personal responsibility
to upgrade their apps
to ensure they have the latest security protocols
for their product."
He added, "That all current chargers
meet the highest security standards today."
But cybersecurity experts say
other cracks aren't that hard to find.
Multiple studies have found bugs
that could allow hackers to connect to a charger remotely
and install malware.
This opens the door for an attacker
to overheat an EV battery, hijack a wifi network,
or even take control of an entire vehicle.
But it's the cumulative impact of these types of attacks
that could cause the most damage.
- So the power grid is designed
to work at a relatively steady state,
and you have a big problem
if you have a huge like surge in demand
or a huge dip in demand.
And either of these could be caused
by a coordinated set of EVs all of a sudden charging
or not charging.
- [Journalist] In a 2020 study,
NYU researchers modeled a hypothetical scenario
where a group of hackers
could use less than 1,000 EV chargers
to take down the Manhattan power grid.
- We've inadvertently created weapons
that could be used against us by foreign powers.
- [Journalist] The growing complexities of EVs
and the networks they're connected to
makes protecting them from attacks even harder.
- You have many more lines of code in your vehicle
than were used in this rockets that went to the moon.
There's just this enormous attack surface.
In general, the more features you have,
the more ways people can go and attack it.
- [Journalist] And while reported hacks
have been relatively minor so far,
the risks are only growing as companies, governments,
and consumers rush to install more chargers.
- There was a case in the south of England
where a charger was hacked
and started displaying pornography.
We've seen a case
at the start of the Russia Ukraine conflict
where Russian EV chargers
started going offline with hacked messages.
So it is happening.
- [Journalist] The Electric Vehicle Charging Association
is a trade group for the public charging network industry
in North America.
It said "That the industry understands
the importance of cybersecurity
and takes it very seriously."
Right now, there are more than 160,000 public chargers
scattered throughout the US, and the 2021 Infrastructure Act
provides funding to help build 500,000 more.
But in this rush to expand EV charging infrastructure
experts say cybersecurity has taken a backseat.
- Everyone wants to move as fast as they can
to get first mover advantage.
Lots of manufacturers rushing to get their product to market
to get market share,
but not quite getting cybersecurity nailed along the way.
- [Journalist] The US doesn't have any regulations
around EV cybersecurity.
But some experts say
it may take a major cyber attack on EV infrastructure
before the industry and lawmakers
step up prevention efforts.
For now, Munro recommends
consumers help take matters into their own hands.
- Make sure you choose a good strong password
that you don't use anywhere else.
And this is perhaps my cynical nature
of being a security researcher.
I don't actually connect my charger to the internet.
I prefer to keep them unconnected and dumb, if you will.